A flaw in Chrome's DevTools allowed a remote attacker to bypass navigation restrictions by loading a crafted HTML page. The vulnerability is caused by insufficient policy enforcement, enabling navigation to URLs that should otherwise be blocked. This flaw falls under an authorization control weakness, exposing the ability to override normal navigation restrictions.

Users running Google Chrome versions earlier than 146.0.7680.71 on Windows, macOS, or Linux operating systems are affected. The issue is specific to the Chrome browser and can impact any user who opens a malicious page that triggers the DevTools feature. Updating to version 146.0.7680.71 or newer resolves the problem.

The flaw carries a CVSS score of 4.3, classified as low severity, and an EPSS score indicating an exploitation probability of less than one percent. It is not listed in CISA’s Known Exploited Vulnerabilities catalog. Because the attacker can trigger the issue from a web page that a user visits, the likely vector is remote web-based. The low score suggests a minimal probability of widespread exploitation, yet the ability to navigate to restricted URLs warrants timely remediation.